diff --git a/src/generic-methodologies-and-resources/pentesting-wifi/README.md b/src/generic-methodologies-and-resources/pentesting-wifi/README.md
index 6abcdeb3042..f8783ead171 100644
--- a/src/generic-methodologies-and-resources/pentesting-wifi/README.md
+++ b/src/generic-methodologies-and-resources/pentesting-wifi/README.md
@@ -1062,6 +1062,33 @@ Some consumer IoT relays/controllers keep the commissioning **open AP** active a
 
 For persistence, leave the commissioning AP enabled.<sup>[[2]](#references)</sup>
 
+## Broadcast-derived PSKs and management-plane credential pivot
+
+Treat every value advertised before authentication—SSID, BSSID, model and serial-like suffixes—as public input. Check whether the commissioning AP uses a fixed PSK, the device serial, or a deterministic transformation of one of these values. In one battery-gateway deployment, legacy units used `12345678`, while later guidance reused an inverter serial already embedded in an SSID such as `WK12345G67`; association therefore required no WPA handshake cracking. Searching authorized wardriving datasets for the SSID pattern may also correlate an identifier with a location, although exploitation still needs radio proximity or another route to the gateway.<sup>[[30]](#references)</sup>
+
+A gateway that keeps its AP active while operating as a **station (STA)** on a trusted WLAN—or while connected to that LAN by Ethernet—is a cross-zone pivot candidate. Do not assume it routes packets between interfaces: first inspect AP-side Telnet/HTTP/API configuration for plaintext STA PSKs, exported configuration, cloud credentials, or a scripting/request primitive. In the reported chain, default `admin`/`admin` Telnet access exposed the PSK of the trusted WLAN, allowing the attacker to leave the commissioning network and authenticate directly to the home network.<sup>[[30]](#references)</sup>
+
+A low-impact authorized workflow is:<sup>[[30]](#references)</sup>
+
+1. Capture beacons passively and compare the SSID with labels, manuals, QR data and other public device identifiers. Test only the small set of documented/default derivations before attempting conventional WPA cracking.
+2. After joining the AP, identify its gateway and probe likely management ports individually and slowly; embedded stacks may not tolerate a normal high-rate scan.
+
+   ```bash
+   ip route | grep default
+   for p in 23 80 502 8099 8899; do
+       nc -nvz -w 2 <gateway_ip> "$p"
+       sleep 1
+   done
+   ```
+
+3. Try documented/default credentials with very few attempts, then enumerate **read-only configuration first**. Treat stored station credentials as a higher-trust secret even though they are exposed through the lower-trust AP.
+4. Determine whether the compromise yields (a) a reusable STA PSK, (b) direct Ethernet/L3 reachability, or (c) only an application-layer egress primitive. Validate a pivot with a controlled host rather than scanning the trusted LAN.
+5. Continue service-specific testing in [Pentesting Telnet](../../network-services-pentesting/pentesting-telnet.md) and [Pentesting Modbus](../../network-services-pentesting/pentesting-modbus.md). For cloud APIs, reuse two accounts you control and substitute only the device identifier as described in [IDOR/BOLA testing](../../pentesting-web/idor.md); a serial number is an object selector, not proof of ownership.
+
+### Scan-triggered reset as a destructive primitive
+
+On resource-constrained gateways, enumeration itself can become a state-changing attack: a request burst or aggressive port scan may crash the network module, and recovery may restore factory defaults rather than merely reboot it. Before stress testing in a lab, record the SSID/authentication mode, DHCP behavior, uptime and configuration; maintain physical recovery access; then increase only one rate or protocol variable at a time. Loss of ARP/management responses followed by a default SSID, default credentials or erased settings confirms a reset/DoS boundary and should stop further scanning.<sup>[[30]](#references)</sup>
+
 ## References
 
 - [1] [Wifiphisher - The Rogue Access Point Framework](https://github.com/wifiphisher/wifiphisher)
@@ -1093,5 +1120,6 @@ For persistence, leave the commissioning AP enabled.<sup>[[2]](#references)</sup
 - [27] [en.wikipedia.org - Extensible Authentication Protocol](https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol)
 - [28] [intel.com - Network And I O - Wireless Networking](https://www.intel.com/content/www/us/en/support/articles/000006999/network-and-i-o/wireless-networking.html)
 - [29] [interlinknetworks.com - App Notes - Eap Peap](https://www.interlinknetworks.com/app_notes/eap-peap.htm)
+- [30] [GivEnergy enters administration, batteries expose home networks](https://pentestpartners.com/security-blog/givenergy-enters-administration-legacy-home-batteries-still-expose-customer-networks)
 
 {{#include ../../banners/hacktricks-training.md}}